eCommerce & Marketplaces Compliance in Brazil

Brazil is open to domestic and foreign e-commerce operators, and cross-border sellers can sell directly to consumers. The rules that shape onboarding are not licensing rules but consumer, child-protection, tax and anti-counterfeiting duties that fall mainly on the platform.

The principal authorities are the National Data Protection Agency (ANPD), which enforces the Digital Statute for Children and Adolescents and the Brazilian Data Protection Law (LGPD), the National Consumer Secretariat (Senacon) of the Ministry of Justice and Public Security, the Federal Revenue Service (Receita Federal) and, for high-value goods, COAF.

The biggest obstacle for a new entrant in 2026 is the combination of two new identity duties: verified age checks for restricted products, and validated identity and payment data for every third-party seller.

1. Who regulates this sector

2. Licensing and authorisation

No federal licence is needed to operate an online shop or marketplace. The conditions for selling online come from consumer law: under Decreto nº 7.962, de 15 de março de 2013 (the e-commerce decree), every website or app used to offer or conclude a consumer contract must display prominently the supplier's business name, CPF or CNPJ, addresses, essential product characteristics and all additional costs (art. 2).

Cross-border sellers

The Remessa Conforme programme of the Receita Federal is a voluntary certification for domestic or foreign e-commerce companies that ship goods to Brazil under the simplified tax regime. Applicants file a seller admission and monitoring policy. Any supplier of an information technology product or service caught by the Digital Statute for Children and Adolescents must keep a legal representative in Brazil with powers to receive service of process and answer to authorities (Lei nº 15.211/2025, art. 40).

A platform that offers payment accounts or executes payment instructions may itself be a payment institution under Lei nº 12.865/2013, art. 6, III. Breaching the platform duties below can lead to suspension or a ban on operating in Brazil (Lei nº 15.502/2026, art. 5; Lei nº 15.211/2025, art. 35).

3. AML, KYC and customer due diligence

E-commerce as such is not an obliged sector under the AML law, Lei nº 9.613, de 3 de março de 1998. Art. 9, sole paragraph, XII, does however cover any person who sells luxury or high-value goods, intermediates their sale or handles large volumes of cash; art. 9, sole paragraph, XI, covers sellers of jewellery, precious stones and metals, art and antiques. A marketplace or retailer that sells or brokers such goods is in scope, under COAF supervision, for that business line; the rule does not distinguish marketplace models, so platforms that only facilitate such sales should assess their position.

The R$ 10,000 test

Resolução Coaf nº 25/2013 applies to anyone who sells, or intermediates the sale of, movable goods with a unit value of R$ 10,000 or more, including through auctions (art. 1). For operations of R$ 10,000 or more, the firm must:

Identify customers

Individuals: full name, CPF, ID document number and issuer (passport data for foreigners) and address. Companies: name, CNPJ, representative's details and address (art. 2).

Record operations

Customer, detailed description of the goods, value, date, form and means of payment (art. 3), kept for at least 5 years (art. 7).

Report to COAF

Automatically: cash payments or receipts of R$ 30,000 or more involving one customer within six months (art. 4). On suspicion: any operation that may indicate money laundering (art. 5), within 24 hours and without tipping off (Lei nº 9.613/1998, art. 11).

Register with COAF

Register and keep registration current in COAF's Siscoaf system (art. 8; Instrução Normativa Coaf nº 5/2020).

Risk-based programme

Resolução Coaf nº 36/2021 requires a documented AML policy, an internal risk assessment reviewed at least every two years, and customer identification, qualification and risk classification. Identity must be verified and validated, including for non-face-to-face operations (art. 7, § 3); beneficial owners of corporate customers must be identified using an ownership threshold no higher than 25% (art. 9); and no relationship may begin before identification and qualification are complete (art. 10). Politically exposed persons are handled under Resolução Coaf nº 40/2021, and since 3 August 2026 Instrução Normativa Coaf nº 1/2026 requires enhanced due diligence for operations linked to jurisdictions the Financial Action Task Force (FATF) lists as high-risk. Obliged persons must also freeze, without delay and without prior notice, assets of persons designated under United Nations Security Council sanctions and report the freeze to COAF and the Ministry of Justice and Public Security (Lei nº 13.810/2019, art. 9; Resolução Coaf nº 31/2019, art. 3).

Other online retail has no formal customer identification rule.

4. Identity verification and onboarding

Verifying sellers

Lei nº 15.502, de 10 de setembro de 2026 requires e-commerce platforms to adopt minimum preventive measures against illicit and counterfeit goods, starting with the verification and validation of sellers' registration data, including CPF or CNPJ, bank account, digital wallet or other associated means of payment (art. 3, I). Platforms must also run reporting channels, remove illicit listings, suspend infringers, audit sellers (art. 3, II to IV) and share sellers' data and transaction history with the authorities (art. 4). Remessa Conforme platforms must also trace foreign sellers (Decreto-Lei nº 1.804/1980, art. 3-A).

Verifying buyers' age

The Digital Statute for Children and Adolescents (Lei nº 15.211, de 17 de setembro de 2025, the "ECA Digital"), in force since 17 March 2026, requires reliable age verification at each access to products prohibited to under-18s, and bans self-declaration (art. 9, § 1). Decreto nº 12.880, de 18 de março de 2026 lists those products: weapons, ammunition and explosives, alcoholic drinks, tobacco and other smoking products including electronic cigarettes, products that can cause dependence, fireworks, gambling, betting and lotteries, loot boxes, pornography, escort services and sexual dating services, plus anything else the law bans for minors (art. 15, § 1). A supplier that offers or intermediates the sale of the first seven categories must verify age either:

• at registration, with purchases blocked by default for minors and no unlocking by self-declaration; or
• at the point of purchase, so that a minor cannot complete the order (art. 18).

Unregistered or unauthenticated users are blocked at the point of purchase by default (Decreto nº 12.880/2026, art. 18, sole paragraph). Methods must be proportionate, accurate, data-minimising and auditable (art. 24), and users can contest results (art. 27). Websites may use age signals from operating systems or app stores but remain responsible for the outcome (art. 26, §§ 2 and 3).

Some listed products cannot be sold online at all: the Brazilian Health Regulatory Agency (Anvisa) bans online and postal sales of tobacco products (RDC nº 840/2023, arts. 6 and 9; Lei nº 9.294/1996, art. 3º-A, I) and any sale of e-cigarettes (RDC nº 855/2024), and fixed-odds betting is prohibited under Medida Provisória nº 1.394/2026, which has force of law but lapses unless Congress converts it (deliberation period ends 23 November 2026 unless extended). Firearm buyers need a purchase authorisation from the national firearms system (Sinarm) and, with limited exceptions, must be 25 or older (Lei nº 10.826/2003, arts. 4 and 28).

Accepted methods

No specific document or technology is mandated. The ANPD's preliminary guidance (March 2026) treats self-declaration as unreliable, asks suppliers to measure and document accuracy, and urges caution with facial biometrics where less intrusive methods work. Where an ID document is captured, only the age may be processed: the image and extracted data must be deleted immediately and irreversibly (Decreto nº 12.880/2026, art. 24, § 3). The ANPD's draft update of May 2026 [Draft, not final] classes prohibited products as high risk and points to layered approaches: age signals, verifiable credentials, facial age estimation backed by verification, and document verification with liveness detection.

5. Digital channels: what's different

Bottom line: the sale of age-restricted goods is banned to minors in every channel, but only online does the law dictate how age must be checked: a reliable verification at sign-up or checkout, never self-declaration, with document images deleted at once.

A verified age gate, chosen by risk

Operators may verify age once at registration or at each restricted purchase (Decreto nº 12.880/2026, art. 18). Where the operator's own age check disagrees with an app store or operating system age signal, it must apply the more protective result (art. 25, § 4).

Cooling-off and refunds

Off-premises contracts carry a 7-day withdrawal right with immediate refund (Lei nº 8.078/1990, art. 49), exercisable through the same tool used to buy, with the card issuer told at once to cancel or reverse the charge (Decreto nº 7.962/2013, art. 5).

Pending: the ANPD's definitive age assurance guidance [Consultation closed 9 Jul 2026, final text pending] and the regulation of the platform penalties in Lei nº 15.502/2026.

6. Data protection and biometrics

Under the Brazilian Data Protection Law (LGPD, Lei nº 13.709/2018), biometric data are sensitive (art. 5, II). They may be processed with specific, highlighted consent (art. 11, I) or, without consent, to prevent fraud in identification and authentication in electronic systems (art. 11, II, g). Processing children's data requires specific, highlighted consent from at least one parent or legal guardian (art. 14, § 1).

The ECA Digital adds a strict purpose limit: age verification data may be used only for that purpose (art. 13) and may not feed advertising profiles (Decreto nº 12.880/2026, art. 24, § 1). Suppliers likely to be accessed by minors must also carry out a child safety and health impact assessment and publish a summary (Decreto nº 12.880/2026, art. 47).

7. Sector-specific obligations

Consumer duties

Suppliers must show a contract summary before the order, let buyers correct input errors, confirm acceptance immediately, provide the contract in a durable form and answer complaints within five days (Decreto nº 7.962/2013, art. 4). Marketplaces and digital platforms with gross revenue of R$ 100 million or more, an average of 1,000 or more complaints a month, or more than 500 consumer lawsuits must register on Senacon's consumidor.gov.br complaint platform (Portaria Senacon nº 12/2021, art. 2).

Marketplace liability and platform duties

The Federal Supreme Court (STF) has held that internet application providers acting as marketplaces are civilly liable under the Consumer Defence Code, not the fault-based regime that applies to other platforms (Tema 987, final since 17 June 2026). Under Decreto nº 12.975/2026, application providers must keep a seat and legal representative in Brazil, and those selling paid ads must keep ad and advertiser records for one year (Decreto nº 8.771/2016, arts. 16-A and 16-M). Lei nº 15.502/2026 adds quarterly reports to the CNCP on action taken against illegal products (art. 4, sole paragraph).

Marketplaces as tax intermediaries

Under the consumption tax reform, digital platforms, even if domiciled abroad, are liable for the goods and services tax (IBS) and the social contribution on goods and services (CBS) on sales made through them: jointly with the buyer and in place of the supplier when the supplier is abroad, and jointly with a domestic supplier when the platform does not report the sale or the supplier does not issue an electronic tax invoice (Lei Complementar nº 214/2025, art. 22, as amended by Lei Complementar nº 227/2026). Platforms must report the operations they intermediate to the IBS Management Committee and the Receita Federal, identifying the supplier even if it is not a taxpayer (art. 22, § 5; Decreto nº 12.955/2026, art. 20, § 4). In 2026, the transition year, IBS and CBS payment is waived for taxpayers that meet their reporting obligations (Lei Complementar nº 214/2025, art. 348, § 1). For cross-border parcels sold by Remessa Conforme-certified companies to individuals, import duty is zero up to US$ 50 and 60%, less US$ 30, from US$ 50.01 to US$ 3,000 (Portaria MF nº 156/1999, art. 1º-B, § 2, as amended by Portaria MF nº 1.342, de 12 de maio de 2026); uncertified sites pay 60%, according to the Receita Federal.

Wider ECA Digital duties

The ANPD's guide on the scope of the ECA Digital (October 2026) places e-commerce platforms that intermediate products prohibited to minors among the categories presumed to be likely accessed by children, unless the operator shows otherwise. Such services must offer parental supervision tools that let parents restrict purchases and financial transactions (Lei nº 15.211/2025, art. 18, II) and may not use manipulative design that weakens these safeguards (art. 18, § 2).

8. Risk indicators and red flags

High-value goods and marketplace typologies (COAF and federal law)

• Mismatched means: purchases apparently incompatible with the buyer's known or presumed economic capacity.
• Third-party payment: an order paid by someone other than the buyer without a plausible reason.
• Overpay and refund: payment above the price followed by a request to return the difference.
• Cancel and refund: cancellation or withdrawal with a refund request, without a plausible reason.
• Off-market terms: willingness to negotiate prices or conditions outside market norms.
• Document resistance: refusal to provide identification, or documents whose accuracy is doubtful.
• Shipment manipulation: under-invoicing, artificial splitting of shipments or a concealed sender.
• Age-gate evasion: multiple accounts or other devices used to get around age verification.

Sources: Instrução Normativa Coaf nº 7/2021, art. 2 (first six); Decreto-Lei nº 1.804/1980, art. 3-A; Decreto nº 12.880/2026, arts. 25 and 29.

9. Enforcement and penalties

Recent actions: on 28 October 2026 Senacon ordered five online ticket resale marketplaces to stop intermediating new resales within 72 hours, under a daily fine of R$ 100,000 each, under Decreto nº 13.108/2026 on ticket sales, citing missing information on the seller's legal status and total price. On 25 August 2026 the ANPD fined ByteDance R$ 153.7 million for five LGPD infringements involving children's and adolescents' data on TikTok, including processing without a valid legal basis.

10. Recent changes and what to watch

• 28 October 2026[Published guidance] The ANPD's guide on the scope of the ECA Digital presumes that marketplaces selling products prohibited to minors are likely to be accessed by children.
• October 2026[Consultation, closes 30 Nov 2026] The ANPD is revising its sanctions regulation to cover its ECA Digital powers, which will set how age verification failures are fined.
• 10 September 2026[In force; penalties await regulation] Lei nº 15.502/2026 requires seller verification, notice and takedown, seller audits and quarterly CNCP reports from e-commerce platforms.
• 9 July 2026[Final guidance pending] Consultation on the ANPD's updated age assurance guidance closed; the March 2026 preliminary guidance remains its monitoring reference.
• 17 June 2026[Final judgment] The STF's ruling that marketplaces answer under the Consumer Defence Code became final.
• 17 and 18 March 2026[In force] The ECA Digital took effect, and Decreto nº 12.880/2026 set the age verification rules for restricted products.

11. What this means for identity verification

• Two populations, two checks. Sellers need validated tax ID and payment data; buyers of restricted goods need a verified age, not a verified identity.
• Age without identity. Age checks should return an over-18 result and discard document images and extracted data immediately.
• Choose the trigger. Verify at account creation or at each restricted checkout; block guest checkout for restricted goods either way.
• High-value lines are KYC lines. For items of R$ 10,000 or more, collect CPF, ID document and address, screen for politically exposed persons and sanctions, identify beneficial owners of corporate buyers and keep records for 5 years.